Executive brief
Samba, a widely used software suite for file and print sharing between Windows and Linux systems, contains a vulnerability in its printing subsystem. An attacker can send a specially crafted print job description containing malicious commands that the server will execute. This could allow an unauthorized user to take complete control of the server, potentially leading to data theft or service disruption.
Technical details
An OS command injection vulnerability (CWE-78) exists in the Samba printing subsystem. The flaw occurs because Samba passes client-controlled job description strings to the system's 'print command' using the '%J' substitution character without properly escaping shell meta-characters. A remote attacker with permission to submit print jobs can exploit this by providing a job description containing unescaped shell characters (e.g., pipes or semicolons). This results in the execution of arbitrary commands with the privileges of the Samba process. The vulnerability affects Samba versions 4.1 and newer; patches have been developed for versions 4.21 through 4.24 and the master branch.
Affected products
- Samba Samba 4.1 and newer
Timeline
- 2026-03-15: other: Vulnerability reported to Samba maintainers
- 2026-03-27: disclosed: Initial Red Hat bug report created (embargoed)
- 2026-05-26: advisory: Public disclosure and CVE assignment
- 2026-05-26: patched: Fixes resolved in Samba Bugzilla